Cybersecurity M&A shows little sign of fatigue

Macroeconomic concerns have caused many technology investors to hit the brakes, but cybersecurity M&A has shown little sign of slowing down.

Many cybersecurity stocks have been pressured amid the broader sell-off as the 2022 market correction pressured equities. However, a large number of individual cybersecurity companies are still valued well above market averages, and M&A volumes and values continue to outpace those in most sectors.

The first quarter saw a sharp 26.3% increase in cybersecurity M&A activity year over year. That growth was not against an easy 2021 comparison. The only year of the past five that has seen a decline in activity was 2019, when deals dropped by 2.9% from 2018.

Several factors have driven the pace of M&A in the sector, not least increasing demand due to new enterprise dynamics catalyzed by the pandemic period. Many enterprises transitioned much of their operations to digital platforms over the past two years. Some of that transition was already part of longer-term digital transformation strategies, and some were in response to new and unforeseen scenarios imposed by the pandemic, like the spike in remote working activity.

"I do think fundamentals and all the drivers remain in place," 451 Research analyst Garrett Bekker said.

The shift toward digital has required enterprises to update and expand cybersecurity security investments, which in turn accelerated cybersecurity innovation and consolidation. While the first quarter of 2022 saw many fewer deals with reported terms, deal volumes increased dramatically.

"Cybersecurity has been a hot investment area for some time, but the pandemic really accelerated interest in the sector," said Merlin Piscitelli, chief revenue officer for Datasite's EMEA region. "Cyber criminals sought to take advantage of this, sometimes even paralyzing critical services and infrastructure."

High-profile cybersecurity breaches have further driven the investment thesis for both enterprise and government. In some cases, government regulators are now mandating certain cybersecurity investments on the part of critical private sectors.

Another driver for cyber M&A is talent acquisition. There are between 2 million and 3 million unfilled cybersecurity positions globally, and some acquisitions are primarily motivated to bring in labor, Bekker and Piscitelli said.

These factors have led some of the highest valuation multiples on the market.

The 11.6x average cyber M&A deal multiple posted in the first quarter represents a slight retreat from the year-ago period, but is nevertheless about triple the average 3.3x M&A multiple across the technology industry, according to 451 data.

Acquirers include other cybersecurity companies looking to expand, information technology companies looking to secure their non-security products, operating companies outside the technology sector that manage sensitive data and private financial firms, which have moved into the sector en force in recent years.

451 Research is part of S&P Global Market Intelligence.

Comments are closed.